4.1.1.3 Ensure auditing for processes that start prior to auditd is enabled

Information

Configure grub2 so that processes that are capable of being audited can be audited even if they start up prior to auditd startup.

Audit events need to be captured on processes that start up prior to auditd so that potential malicious activity cannot go undetected.

Solution

Run the following command to add audit=1 to GRUB_CMDLINE_LINUX :

# grubby --update-kernel ALL --args 'audit=1'

See Also

https://workbench.cisecurity.org/files/3742

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2

Plugin: Unix

Control ID: c11cc98c80b69849cb3663e0607913543ad8109190c898093e3a5b07a73e993e